How to resolve time_stamp Mapping conflict?

(SK) #1

I got Mapping issue in kibana4. From my logstash configuration below are the two fields renamed to time_stamp.
Before it was working fine and it type is 'String'. Now I am getting conflict message in field 'time_stamp'. Using kibana4.

rename => [ "timeStamp" , "time_stamp" ]
rename => [ "RunTime" , "time_stamp" ]
locale => "en"
match => [ "time_stamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
timezone => "America/Chicago"
target => "time_stamp"


Please help me how to resolve this issue.

(SK) #2

In the Discover page the field 'time_stamp' shows not indexed.

(Lukas Olson) #3

Can you provide the template mapping you are using? Are you sure that the time_stamp field is actually being indexed in Elasticsearch?

You might want to also post this question in the Logstash forums to receive help on how to ensure that the field is actually being indexed.

(system) #4